Re: MaxMind GeoIP support in 3.0.8.2
"David Edelman" <[email protected]> Mon, 1 Oct 2018 16:14:37 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. ------=_NextPart_000_0046_01D459A1.DA8282E0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable You are going to need to escape the special characters so the single = quote might be less of a hassle than adding a bunch of backslash = characters=20 =20 =20 --Dave =20 =20 From: Carter Bullard <[email protected]>=20 Sent: Monday, October 1, 2018 10:40 AM To: Kevin Branch <[email protected]> Cc: Argus <[email protected]>; [email protected] Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 =20 Hey Kevin, I think I figured out a better regex for your =E2=80=9CFL=E2=80=9D in = both scity and dcity, regardless of order and placement in the label = =E2=80=A6 =20 (?=3D.*\bscity=3D[^:]+FL\b)(?=3D.*\bdcity=3D[^:]+FL\b).+ =20 This will require that you compile the clients with a pcre library, as = some regex libraries don=E2=80=99t support =E2=80=9C?=3D.=E2=80=9D = repetition. That can be specified at ./configure time . =20 Carter =20 On Oct 1, 2018, at 9:50 AM, Carter Bullard <[email protected] = <mailto:[email protected]> > wrote: =20 Hey Kevin, Dave is right on the money, and great to see that you guys got it = working !! =20 =20 You can search the label using regular expressions (pcre style regex if = you compiled that library in) just as Dave indicates. You can use a = simple regex like =E2=80=9CFL=E2=80=9D to get the flows that have = anything to do with =E2=80=98FL=E2=80=99 and then do your own parsing to = get exactly what you want, something like: =20 ra -S localhost -M label=3D=E2=80=9CFL=E2=80=9D -s stime saddr daddr = proto spkts dpkts label -c, =20 And then process the label string to get your values, or you can regex = and match the FL as a part of both the =E2=80=98scity=E2=80=99 and = =E2=80=98dcity=E2=80=99 fields. Something like: =20 -M label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2=80=9D =20 In general, the labeler will put the scity, then the dcity values into = the label in that order, and should put the values you specify on the = line into the label, in the order given. But, because a previous = labeler could have put scity and/or dcity values in the label before you = put your values, you don=E2=80=99t know what the order of values maybe = for scity or dcity. When there are multiple values, ralabel and radium = have the ability to reorder values, so that it can deal with duplicate = values. Daves regex will match if FL is just after the = =E2=80=98=3D=E2=80=98 which will cover 95% of the scenarios. I have = multiple labelers, radium is always putting lat,lon bounding boxes for = IP addresses, so if I have something later putting in city codes, it may = end up at the end of a list of other objects that apply to = =E2=80=99scity=E2=80=99 or =E2=80=98dcity=E2=80=99. And of course, the = =E2=80=99scity=E2=80=99 and =E2=80=98dcity=E2=80=99 may not be in that = order =E2=80=A6 In this case the best regex may be: =20 -M label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D =20 This matches scity=E2=80=A6FL and dcity=E2=80=A6FL regardless of the = order in the label. May still need some tweaking, but hopefully you get = the idea ... =20 Carter =20 On Sep 30, 2018, at 10:42 AM, David Edelman <[email protected] = <mailto:[email protected]> > wrote: =20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1=20 Use the ra command line flag -M = label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I seem to remember = that regular expressions work for this filter. Use the single quote to = escape the *=20 =20 If the regular expression doesn=E2=80=99t work let me know. You = can=E2=80=99t use ragrep since that looks at theuser data portion of = the flow, not the label metadata. =20 - --Dave=20 =20 From: Kevin Branch < <mailto:[email protected]> = [email protected]>=20 Sent: Saturday, September 29, 2018 11:14 PM=20 To: David Edelman < <mailto:[email protected]> [email protected]>=20 Cc: Carter Bullard < <mailto:[email protected]> [email protected]>; = Argus < <mailto:[email protected]> = [email protected]>=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 =20 David, thanks! That was the missing piece.=20 =20 I switched to=20 =20 RALABEL_GEOIP_CITY=3D"saddr,daddr:region,cco"=20 =20 and I saw what I wanted:=20 =20 # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf = -r - -s label:30 -N20=20 Label=20 scity=3DFL,US:dcity=3DMO,US=20 =20 All along I have been trying to label source and destination IPs with = state,country like above. It took a fair bit of experimenting to get = the state part figured out due to that field being referred to as "reg" = in the ralabel.conf comment documentation while actually it has to be = referenced as "region" to work. =20 Now for my hopefully last question: How can I have ra use that label = content as search criteria? I am trying to use ra to count up total = traffic volume seen where the source and destination IP are both in = Florida. I suspect ra will not let me use label, scity or dcity values = as filter criteria. Can ragrep help here? Or will I have to go the = rasqlinsert route to accomplish this? =20 Thanks,=20 Kevin=20 =20 =20 On Sat, Sep 29, 2018 at 3:47 PM David Edelman < = <mailto:[email protected]> [email protected] < = <mailto:[email protected]> mailto:[email protected]> > wrote:=20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1=20 It looks like we are almost there, you need to indicate which = addresses need to have the labels associated=20 Please change this in your configuration file=20 =20 =20 RALABEL_GEOIP_CITY=3D"saddr,daddr:city "=20 =20 This information might help Looking at the code, the netmask is = not functional=20 =20 #=20 # Data for city relevant data is enabled through enabling and = configuring=20 # the city database support. The types of data available = are:=20 # country_code, country_code3, country_name, region, city, = postal_code,=20 # latitude, longitude, metro_code, area_code and = continent_code.=20 # time_offset is also available.=20 #=20 # The concept is that you should be able to add semantics for = any=20 # IP address that is in the argus record. Support addresses = are:=20 #=20 # saddr, daddr, inode=20 #=20 # The labels provided will be tagged as:=20 # scity, dcity, icity=20 #=20 # To configure what you want to have placed in the label, use = the list of=20 # objects, in whatever order you like, as the = RALABEL_GEOPIP_CITY string=20 # using these keywords:=20 # cco - country_code=20 # cco3 - country_code3=20 # cname - country_name=20 # reg - region=20 # city - city=20 # pcode - postal_code=20 # lat - latitude=20 # long - longitude=20 # metro - metro_code=20 # area - area_code=20 # cont - continent_code=20 # netmask - netmask value=20 #=20 # Working examples could be:=20 # RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"=20 # RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"=20 #=20 #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"=20 #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"=20 =20 =20 =20 - --Dave=20 =20 =20 =20 From: Kevin Branch < <mailto:[email protected]> = [email protected] < <mailto:[email protected]> = mailto:[email protected]> >=20 Sent: Saturday, September 29, 2018 11:57 AM=20 To: Carter Bullard < <mailto:[email protected]> = [email protected] < <mailto:[email protected]> = mailto:[email protected]> >=20 Cc: David Edelman < <mailto:[email protected]> = [email protected] < <mailto:[email protected]> = mailto:[email protected]> >; Argus < = <mailto:[email protected]> [email protected] = < <mailto:[email protected]> = mailto:[email protected]> >=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 =20 Hi Carter and David,=20 =20 I just tried the following with the same ralabel.conf as before: = ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20=20 and saw this. Looks like I was using the wrong syntax which I = am glad to know better now, but the GeoIP lookups are still not = happening: "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 =20 I know the data file is good because it works with this:=20 # geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat = 207.48.48.19=20 GeoIP City Edition, Rev 1: US, MO, Missouri, = Chesterfield, 63017, 38.650002, -90.533401, 609, 314=20 =20 In case it helps, I rebuilt argus-clients with the .debug flag = file present and then ran this command limited to only a single argus = record that I independently confirmed has a srcip value known to = geoiplookup # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f = /etc/ralabel.conf -r - -s label:50 -N200 -D3=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 = ArgusNewLabeler (0x7f8eff3f7010, 0) returning 0x1b057c0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 = ArgusReadConnection() read 16 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 = ArgusReadConnection() read 112 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 = ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 = ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: = reading files completed=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 = ArgusShutDown (0)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 = RaParseComplete (0) returning=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 = RaParseComplete(caught signal 0)=20 <mailto:[email protected]> = [email protected]:~/argus-clients-3.0.8# < = <mailto:[email protected]:~/argus-clients-3.0.8> = mailto:[email protected]:~/argus-clients-3.0.8#> < = <mailto:[email protected]:~/argus-clients-3.0.8> = mailto:[email protected]:~/argus-clients-3.0.8#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D8 ralabel[4462.40472429a37f0000]: 15:53:24.374433 = ArgusFree (0x26b2250)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374461 = ArgusFree (0x26b22b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374469 = ArgusFree (0x26b2310)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374474 = ArgusFree (0x26b2370)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374479 = ArgusFree (0x26b23d0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374484 = ArgusFree (0x26b2430)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374489 = ArgusFree (0x26b2490)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374494 = ArgusFree (0x26b24f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374499 = ArgusFree (0x26b2550)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374504 = ArgusFree (0x26b25b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374509 = ArgusFree (0x26b2610)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374533 = ArgusCalloc (1, 80) returning 0x26b2610=20 ralabel[4462.40472429a37f0000]: 15:53:24.374544 = ArgusCalloc (1, 296) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374566 = ArgusCalloc (1, 112) returning 0x26b2950=20 ralabel[4462.40472429a37f0000]: 15:53:24.374577 = ArgusCalloc (1, 80) returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374595 = ArgusNewQueue () returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374613 = ArgusCalloc (65536, 8) returning 0x2849a010=20 ralabel[4462.40472429a37f0000]: 15:53:24.374619 = ArgusNewLabeler (0x7fa329100010, 0) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384352 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384387 = ArgusCalloc (1, 560) returning 0x26b2250=20 ralabel[4462.40472429a37f0000]: 15:53:24.384411 = ArgusCalloc (1, 112) returning 0x26b2e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.384418 = ArgusCalloc (1, 80) returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384424 = ArgusNewQueue () returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384430 = ArgusCalloc (1, 56) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384454 = ArgusCalloc (65536, 8) returning 0x27358010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384461 = ArgusNewHashTable (65536) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384483 = ArgusReadConnection() read 16 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384498 = ArgusReadConnection() read 112 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384514 = ArgusCalloc (1, 4194304) returning 0x26f57010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384523 = ArgusCalloc (1, 262144) returning 0x26f16010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385934 = ArgusInitAddrtoname (0x7fa329100010, 0xa9fe6700, 0xffffff00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.385969 = ArgusReadFileStream() starting=20 ralabel[4462.40472429a37f0000]: 15:53:24.385981 = ArgusReadStreamSocket (0x7fa32908f010) read 380 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386015 = ArgusCalloc (1, 384) returning 0x26c58c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386025 = ArgusCalloc (1, 12) returning 0x26c5a50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386031 = ArgusCalloc (1, 80) returning 0x26c5a70=20 ralabel[4462.40472429a37f0000]: 15:53:24.386037 = ArgusCalloc (1, 36) returning 0x26c5ad0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386042 = ArgusCalloc (1, 52) returning 0x26c5b00=20 ralabel[4462.40472429a37f0000]: 15:53:24.386047 = ArgusCalloc (1, 80) returning 0x26c5b40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386053 = ArgusCalloc (1, 120) returning 0x26c5ba0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386058 = ArgusCalloc (1, 8) returning 0x26c5c20=20 ralabel[4462.40472429a37f0000]: 15:53:24.386063 = ArgusCalloc (1, 164) returning 0x26c5c40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386070 = ArgusCalloc (1, 20) returning 0x26c5cf0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386075 = ArgusCalloc (1, 20) returning 0x26c5d10=20 ralabel[4462.40472429a37f0000]: 15:53:24.386080 = ArgusCalloc (1, 12) returning 0x26c5d30=20 ralabel[4462.40472429a37f0000]: 15:53:24.386092 = ArgusCalloc (1, 16) returning 0x26c5d50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386131 = ArgusCalloc (1, 12) returning 0x26c5e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.386234 = ArgusAddToRecordLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[4462.40472429a37f0000]: 15:53:24.386280 = ArgusFree (0x26c5a50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386287 = ArgusFree (0x26c5a70)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386292 = ArgusFree (0x26c5ad0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386297 = ArgusFree (0x26c5b00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386301 = ArgusFree (0x26c5b40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386304 = ArgusFree (0x26c5ba0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386308 = ArgusFree (0x26c5c20)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386312 = ArgusFree (0x26c5c40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386316 = ArgusFree (0x26c5cf0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386322 = ArgusFree (0x26c5d10)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386359 = ArgusFree (0x26c5d30)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386369 = ArgusFree (0x26c5e80)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386377 = ArgusFree (0x26c5d50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386384 = ArgusFree (0x26c58c0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386392 = RaProcessRecord (0x2908f630) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386400 = RaScheduleRecord (0x7fa329100010, 0x7fa32908f630) scheduled=20 ralabel[4462.40472429a37f0000]: 15:53:24.386408 = ArgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380 ralabel[4462.40472429a37f0000]: 15:53:24.386417 = ArgusReadStreamSocket (0x7fa32908f010) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386432 = ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386439 = ArgusReadStreamSocket (0x7fa32908f010) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing=20 ralabel[4462.40472429a37f0000]: 15:53:24.386463 = ArgusFree (0x7fa326f57010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386473 = ArgusFree (0x7fa326f16010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386500 = ArgusReadFileStream() returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386522 = ArgusFree (0x7fa32908f010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: = reading files completed=20 ralabel[4462.40472429a37f0000]: 15:53:24.386536 = ArgusShutDown (0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386546 = ArgusFree (0x26b2190)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386553 = ArgusDeleteQueue (0x26b2190) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386561 = ArgusFree (0x26b21f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386569 = ArgusDeleteQueue (0x26b21f0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386599 = RaParseComplete (0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386608 = RaParseComplete(caught signal 0)=20 =20 Thanks for looking at this,=20 Kevin=20 =20 =20 On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard < = <mailto:[email protected]> [email protected] < = <mailto:[email protected]> mailto:[email protected]> < = <mailto:[email protected]> mailto:[email protected]> > wrote:=20 Hey Kevin,=20 Any success ???=20 Carter=20 < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 Carter Bullard =E2=80=A2 CTO < <http://qosient.com/> = http://qosient.com/>=20 150 E 57th Street Suite 12D < <http://qosient.com/> = http://qosient.com/>=20 New York, New York 10022-2795 < <http://qosient.com/> = http://qosient.com/>=20 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 < = <http://qosient.com/> http://qosient.com/>=20 =20 On Sep 28, 2018, at 9:40 PM, David Edelman < = <mailto:[email protected]> [email protected] < = <mailto:[email protected]> mailto:[email protected]> > wrote: < = <http://qosient.com/> http://qosient.com/>=20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1 < <http://qosient.com/> = http://qosient.com/>=20 Please try this: < <http://qosient.com/> = http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel = -f /etc/ralabel.conf -r - -s label:200 -N20 < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 From: Argus-info < = <mailto:[email protected]> = [email protected]< = <mailto:[email protected]> = mailto:[email protected]> > On Behalf Of Kevin Branch=20 Sent: Friday, September 28, 2018 5:25 PM=20 To: Carter Bullard < <mailto:[email protected]> = [email protected] < <mailto:[email protected]> = mailto:[email protected]> >=20 Cc: Argus < = <mailto:[email protected]> [email protected] = < <mailto:[email protected]> = mailto:[email protected]> >=20 Subject: Re: [ARGUS] MaxMind GeoIP support in = 3.0.8.2 < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 Looks like GeoIP is linked in already: < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 # ldd `which ralabel`=20 linux-vdso.so.1 =3D> = (0x00007ffddaf8a000)=20 libm.so.6 =3D> = /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000)=20 libpthread.so.0 =3D> = /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000)=20 libGeoIP.so.1 =3D> = /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000)=20 libc.so.6 =3D> = /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000)=20 /lib64/ld-linux-x86-64.so.2 = (0x00007f5fe6acf000) < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 I switched to just "lat,lon" like you suggested = in ralabel.conf: < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 # cat /etc/ralabel.conf < <http://qosient.com/> = http://qosient.com/>=20 RALABEL_ARIN_COUNTRY_CODES=3Dno < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes < = <http://qosient.com/> http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 RALABEL_GEOIP_CITY=3D"lat,lon" < = <http://qosient.com/> http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 But I don't see anything but ASNs getting added = in: < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel = -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 < = <http://qosient.com/> http://qosient.com/>=20 sAS dAS < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 22927 4323 < <http://qosient.com/> = http://qosient.com/>=20 6582 4323 < <http://qosient.com/> = http://qosient.com/>=20 7018 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 3 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 15169 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 15169 < <http://qosient.com/> = http://qosient.com/>=20 4323 21928 < <http://qosient.com/> = http://qosient.com/>=20 2828 4323 < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 Thoughts? < <http://qosient.com/> = http://qosient.com/>=20 Kevin < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> http://qosient.com/>=20 On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard < = <mailto:[email protected]> [email protected] < = <mailto:[email protected]> mailto:[email protected]> < = <mailto:[email protected]> mailto:[email protected]> > wrote: < = <http://qosient.com/> http://qosient.com/>=20 Hey Kevin, < <http://qosient.com/> = http://qosient.com/>=20 If you do a ./configure =E2=80=94help = you=E2=80=99ll see all the options that ./configure supports. If you = specify =E2=80=94with-GeoIP it wants the directory where the GeoIP = library is. < <http://qosient.com/> http://qosient.com/>=20 =E2=80=94with-GeoIP=3DDIR. compile = with GeoIP in <dir> < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 You can check if the library is bound to = the client binaries with ldd =E2=80=A6 < <http://qosient.com/> = http://qosient.com/>=20 ldd `which ralabel` < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 If you=E2=80=99re already bound, the = city stuff should work =E2=80=A6. I=E2=80=99m not familiar with = =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top of my head. = I=E2=80=99m familiar with = =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try lat,lon = as a test, as I use that all the time .. < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 Carter < <http://qosient.com/> = http://qosient.com/>=20 =20 < <http://qosient.com/> = http://qosient.com/>=20 =20 =20 < <http://qosient.com/> = http://qosient.com/>=20 On Sep 28, 2018, at 1:59 PM, = Kevin Branch < <mailto:[email protected]> = [email protected]< <mailto:[email protected]> = mailto:[email protected]> < = <mailto:[email protected]> = mailto:[email protected]> > wrote: < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 Hi Carter, < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 I was just trying today to make = ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even = though the file referred to in ralabel.conf for that purpose exists, no = GeoIP labeling takes place. ASN lookups work great, but ralabel never = adds any scity or dcity fields. < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 My ralabel.conf: < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 = RALABEL_ARIN_COUNTRY_CODES=3Dno < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes = < <http://qosient.com/> http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 = RALABEL_GEOIP_CITY=3D"reg,cco" < <http://qosient.com/> = http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 No errors are thrown by ralabel. = I thought maybe I needed to specially compile in GeoIP support like I = read about here: <https://qosient.com/argus/geolocation.shtml> = https://qosient.com/argus/geolocation.shtml < <http://qosient.com/> = http://qosient.com/>=20 but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: < <http://qosient.com/> = http://qosient.com/>=20 configure: WARNING: = unrecognized options: --with-GeoIP < <http://qosient.com/> = http://qosient.com/>=20 However, I presume the fact that = ASN lookups work means that MaxMind GeoIP support libraries are already = installed, and presumably installed by default in the latest argus now. = < <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | = head -n20 < <http://qosient.com/> http://qosient.com/>=20 sAS dAS < = <http://qosient.com/> http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 22927 4323 < = <http://qosient.com/> http://qosient.com/>=20 6582 4323 < = <http://qosient.com/> http://qosient.com/>=20 7018 4323 < = <http://qosient.com/> http://qosient.com/>=20 4323 3 < = <http://qosient.com/> http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 15169 < = <http://qosient.com/> http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 < <http://qosient.com/> = http://qosient.com/>=20 4323 15169 < = <http://qosient.com/> http://qosient.com/>=20 4323 21928 < = <http://qosient.com/> http://qosient.com/>=20 2828 4323 < = <http://qosient.com/> http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 Any thoughts on what I am = missing or how I might further debug this issue? < <http://qosient.com/> = http://qosient.com/>=20 < <http://qosient.com/> = http://qosient.com/>=20 Thanks! < <http://qosient.com/> = http://qosient.com/>=20 Kevin < <http://qosient.com/> = http://qosient.com/>=20 =20 -----BEGIN PGP SIGNATURE----- < = <http://qosient.com/> http://qosient.com/>=20 = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F=20 = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D=20 =3Dp/tg=20 -----END PGP SIGNATURE----- < = <http://qosient.com/> http://qosient.com/>=20 -----BEGIN PGP SIGNATURE-----=20 iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F = = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D=20 =3DeoBH=20 -----END PGP SIGNATURE-----=20 -----BEGIN PGP SIGNATURE-----=20 iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1F=20 IW8GAJ9tlHBAzoC4LAVWCw09qF4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D=20 =3DCZnI=20 -----END PGP SIGNATURE-----=20 =20 =20 ------=_NextPart_000_0046_01D459A1.DA8282E0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:Helvetica; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.msonormal0, li.msonormal0, div.msonormal0 {mso-style-name:msonormal; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:11.0pt; font-family:"Calibri",sans-serif;} span.apple-converted-space {mso-style-name:apple-converted-space;} span.EmailStyle19 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal>You are = going to need to escape the special characters so the single quote might = be less of a hassle than adding a bunch of backslash characters = <o:p></o:p></p><p class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal>--Dave<o:p></o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><p = class=3DMsoNormal><o:p> </o:p></p><div><div = style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in'><p class=3DMsoNormal><b>From:</b> Carter Bullard = <[email protected]> <br><b>Sent:</b> Monday, October 1, 2018 = 10:40 AM<br><b>To:</b> Kevin Branch = <[email protected]><br><b>Cc:</b> Argus = <[email protected]>; = [email protected]<br><b>Subject:</b> Re: [ARGUS] MaxMind GeoIP support = in 3.0.8.2<o:p></o:p></p></div></div><p = class=3DMsoNormal><o:p> </o:p></p><p class=3DMsoNormal>Hey = Kevin,<o:p></o:p></p><div><p class=3DMsoNormal>I think I figured out a = better regex for your =E2=80=9CFL=E2=80=9D in both scity and dcity, = regardless of order and placement in the label = =E2=80=A6<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal> = (?=3D.*\bscity=3D[^:]+FL\b)(?=3D.*\bdcity=3D[^:]+FL\b).+<o:p></o:p>= </p></div><div><p class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>This will require that you compile the clients with a = pcre library, as some regex libraries don=E2=80=99t support = =E2=80=9C?=3D.=E2=80=9D repetition. That can be specified at = ./configure time .<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal>Carter<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal><br><br><o:p></o:p></p><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><div><p = class=3DMsoNormal>On Oct 1, 2018, at 9:50 AM, Carter Bullard <<a = href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<o:p></o:p></p></div><p = class=3DMsoNormal><o:p> </o:p></p><div><div><p = class=3DMsoNormal>Hey Kevin,<o:p></o:p></p><div><p = class=3DMsoNormal>Dave is right on the money, and great to see that you = guys got it working !! <o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>You can search the label using regular expressions = (pcre style regex if you compiled that library in) just as Dave = indicates. You can use a simple regex like =E2=80=9CFL=E2=80=9D = to get the flows that have anything to do with =E2=80=98FL=E2=80=99 and = then do your own parsing to get exactly what you want, something = like:<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal> ra -S localhost -M = label=3D=E2=80=9CFL=E2=80=9D -s stime saddr daddr proto spkts dpkts = label -c,<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>And then process the label string to get your values, = or you can regex and match the FL as a part of both the = =E2=80=98scity=E2=80=99 and =E2=80=98dcity=E2=80=99 fields. = Something like:<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal> -M = label=3D=E2=80=9Cscity=3D.*FL.*dcity=3D.*FL=E2=80=9D<o:p></o:p></p></div>= <div><p class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>In general, the labeler will put the scity, then the = dcity values into the label in that order, and should put the values you = specify on the line into the label, in the order given. But, = because a previous labeler could have put scity and/or dcity values in = the label before you put your values, you don=E2=80=99t know what the = order of values maybe for scity or dcity. When there are multiple = values, ralabel and radium have the ability to reorder values, so that = it can deal with duplicate values. Daves regex will match if FL is = just after the =E2=80=98=3D=E2=80=98 which will cover 95% of the = scenarios. I have multiple labelers, radium is always putting = lat,lon bounding boxes for IP addresses, so if I have something later = putting in city codes, it may end up at the end of a list of other = objects that apply to =E2=80=99scity=E2=80=99 or = =E2=80=98dcity=E2=80=99. And of course, the = =E2=80=99scity=E2=80=99 and =E2=80=98dcity=E2=80=99 may not be in that = order =E2=80=A6 In this case the best regex may = be:<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal> -M = label=3D"(?=3D.*scity=3D.*FL)(?=3D.*dcity=3D.*FL)=E2=80=9D<o:p></o:p= ></p></div><div><p class=3DMsoNormal><o:p> </o:p></p></div><div><p = class=3DMsoNormal>This matches scity=E2=80=A6FL and dcity=E2=80=A6FL = regardless of the order in the label. May still need some = tweaking, but hopefully you get the idea ...<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal>Carter<o:p></o:p></p></div><div><p = class=3DMsoNormal><o:p> </o:p></p><div><p = class=3DMsoNormal><br><br><o:p></o:p></p><blockquote = style=3D'margin-top:5.0pt;margin-bottom:5.0pt'><div><p = class=3DMsoNormal>On Sep 30, 2018, at 10:42 AM, David Edelman <<a = href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<o:p></o:p></p></div><p = class=3DMsoNormal><o:p> </o:p></p><div><div><p = class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>-----BEGIN = PGP SIGNED MESSAGE-----<span = class=3Dapple-converted-space> </span><br>Hash: SHA1<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>Use the ra = command line flag -M = label=3D=E2=80=99scity=3DFL.*dcity=3DFL=E2=80=99 I seem to = remember that regular expressions work for this filter. Use the single = quote to escape the *<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>If the = regular expression doesn=E2=80=99t work let me know. You can=E2=80=99t = use ragrep since that looks at theuser data portion of the flow, = not the label metadata.<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>- = --Dave<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>From: Kevin = Branch <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a>><span = class=3Dapple-converted-space> </span><br>Sent: Saturday, September = 29, 2018 11:14 PM<span = class=3Dapple-converted-space> </span><br>To: David Edelman <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a>><span = class=3Dapple-converted-space> </span><br>Cc: Carter Bullard <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a>>; Argus <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a>><spa= n class=3Dapple-converted-space> </span><br>Subject: Re: [ARGUS] = MaxMind GeoIP support in 3.0.8.2<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>David, = thanks! That was the missing piece.<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>I switched = to<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>RALABEL_GEOI= P_CITY=3D"saddr,daddr:region,cco"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>and I saw = what I wanted:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'># ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:30 -N20<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = &= nbsp; Label<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = scity=3DFL,US:dcity=3DMO,US<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>All along I = have been trying to label source and destination IPs with state,country = like above. It took a fair bit of experimenting to get the state = part figured out due to that field being referred to as "reg" = in the ralabel.conf comment documentation while actually it has to be = referenced as "region" to = work.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>Now for my = hopefully last question: How can I have ra use that label content = as search criteria? I am trying to use ra to count up total = traffic volume seen where the source and destination IP are both in = Florida. I suspect ra will not let me use label, scity or dcity = values as filter criteria. Can ragrep help here? Or will I = have to go the rasqlinsert route to accomplish = this?<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>Thanks,<span= = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>Kevin<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>On Sat, Sep = 29, 2018 at 3:47 PM David Edelman <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> > = wrote:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = -----BEGIN PGP SIGNED MESSAGE-----<span = class=3Dapple-converted-space> </span><br> &n= bsp; Hash: SHA1<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = It looks like we are almost there, you = need to indicate which addresses need to have the labels associated<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Please change this in your configuration = file<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = RALABEL_GEOIP_CITY=3D"saddr,daddr:city "<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = This information might help Looking at = the code, the netmask is not functional<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # Data for city = relevant data is enabled through enabling and configuring<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # the city database = support. The types of data available are:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = country_code, country_code3, country_name, region, city, = postal_code,<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = latitude, longitude, metro_code, area_code and continent_code.<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = time_offset is also available.<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # The concept is that = you should be able to add semantics for any<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # IP address that is in = the argus record. Support addresses are:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = saddr, daddr, inode<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # The labels provided = will be tagged as:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = scity, dcity, icity<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # To configure what you = want to have placed in the label, use the list of<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # objects, in whatever = order you like, as the RALABEL_GEOPIP_CITY string<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # using these = keywords:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # cco - = country_code<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # cco3 - country_code3<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = cname - country_name<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # reg - region<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # city - city<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = pcode - postal_code<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # lat - latitude<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # long - longitude<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = metro - metro_code<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # area - area_code<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # cont - continent_code<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # netmask - = netmask value<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # Working examples = could be:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = # = RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = #<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"<span= = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"<s= pan = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = - --Dave<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = From: Kevin Branch <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>>= ; ><span = class=3Dapple-converted-space> </span><br> &n= bsp; Sent: Saturday, September 29, 2018 11:57 AM<span = class=3Dapple-converted-space> </span><br> &n= bsp; To: Carter Bullard <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> = ><span = class=3Dapple-converted-space> </span><br> &n= bsp; Cc: David Edelman <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> >; = Argus <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>&= gt; ><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Subject: Re: [ARGUS] MaxMind GeoIP = support in 3.0.8.2<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Hi Carter and David,<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = I just tried the following with the same = ralabel.conf as before:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s label:200 -N20<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = and saw this. Looks like I was = using the wrong syntax which I am glad to know better now, but the GeoIP = lookups are still not happening:<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = "scity=3D:dcity=3D"<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = I know the data file is good because it = works with this:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # geoiplookup -f = /usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = GeoIP City Edition, Rev 1: = US, MO, Missouri, Chesterfield, 63017, 38.650002, -90.533401, 609, = 314<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = In case it helps, I rebuilt argus-clients = with the .debug flag file present and then ran this command limited to = only a single argus record that I independently confirmed has a srcip = value known to geoiplookup<o:p></o:p></span></p></div><div><p = class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = # ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D3<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler = (0x7f8eff3f7010, 0) returning 0x1b057c0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() = read 16 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() = read 112 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname = (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel = (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; &nbs= p; Label<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; scity=3D:dcity=3D<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files = completed<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0) = returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught = signal 0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = <span = class=3Dapple-converted-space> </span><a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a>:~/argus-clients-3= .0.8# <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8"><span = style=3D'color:purple'>mailto:[email protected]:~/argus-clients-3.0.8= </span></a>#> <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8"><span = style=3D'color:purple'>mailto:[email protected]:~/argus-clients-3.0.8= </span></a>#> ra -r /argus/today/unt-01.arg -N1 -w - | ralabel = -f /etc/ralabel.conf -r - -s label:50 -N200 = -D8<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree = (0x26b2250)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree = (0x26b22b0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree = (0x26b2310)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree = (0x26b2370)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree = (0x26b23d0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree = (0x26b2430)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree = (0x26b2490)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree = (0x26b24f0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree = (0x26b2550)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree = (0x26b25b0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree = (0x26b2610)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80) = returning 0x26b2610<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296) = returning 0x26b27c0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) = returning 0x26b2950<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80) = returning 0x26b25b0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () = returning 0x26b25b0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) = returning 0x2849a010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler = (0x7fa329100010, 0) returning 0x26b27c0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile = (/etc/ralabel.conf) returning 0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560) = returning 0x26b2250<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112) = returning 0x26b2e80<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) = returning 0x26b2f00<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () = returning 0x26b2f00<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56) = returning 0x26b2f60<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) = returning 0x27358010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable = (65536) returning 0x26b2f60<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() = read 16 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() = read 112 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304) = returning 0x26f57010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144) = returning 0x26f16010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname = (0x7fa329100010, 0xa9fe6700, 0xffffff00)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream() = starting<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket = (0x7fa32908f010) read 380 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) = returning 0x26c58c0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12) = returning 0x26c5a50<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80) = returning 0x26c5a70<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) = returning 0x26c5ad0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) = returning 0x26c5b00<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80) = returning 0x26c5b40<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120) = returning 0x26c5ba0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) = returning 0x26c5c20<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164) = returning 0x26c5c40<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20) = returning 0x26c5cf0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) = returning 0x26c5d10<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12) = returning 0x26c5d30<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16) = returning 0x26c5d50<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) = returning 0x26c5e80<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel = (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; &nbs= p; Label<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; scity=3D:dcity=3D<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree = (0x26c5a50)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree = (0x26c5a70)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree = (0x26c5ad0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree = (0x26c5b00)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree = (0x26c5b40)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree = (0x26c5ba0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree = (0x26c5c20)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree = (0x26c5c40)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree = (0x26c5cf0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree = (0x26c5d10)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree = (0x26c5d30)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree = (0x26c5e80)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree = (0x26c5d50)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree = (0x26c58c0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord = (0x2908f630) returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord = (0x7fa329100010, 0x7fa32908f630) scheduled<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord = (0x7fa326f57010, 0x7fa329221800) returning = 380<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket = (0x7fa32908f010) returning 0<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket = (0x7fa32908f010) read 0 bytes<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket = (0x7fa32908f010) returning 1<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree = (0x7fa326f57010)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree = (0x7fa326f16010)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream() = returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree = (0x7fa32908f010)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files = completed<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree = (0x26b2190)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue = (0x26b2190) returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree = (0x26b21f0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue = (0x26b21f0) returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0) = returning<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = = ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught = signal 0)<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Thanks for looking at this,<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Kevin<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = On Sat, Sep 29, 2018 at 11:18 AM Carter = Bullard <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> = <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> > = wrote:<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = Hey Kevin,<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = Any success ???<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = Carter<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Carter Bullard =E2=80=A2 CTO <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = 150 E 57th Street Suite 12D <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = New York, New York 10022-2795 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = Phone +1.212.588.9133 =E2=80=A2 Mobile = +1.917.497.9494 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = <span = class=3Dapple-converted-space> </span><br> &n= bsp; On Sep 28, = 2018, at 9:40 PM, David Edelman <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> > = wrote: <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; -----BEGIN PGP SIGNED MESSAGE-----<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; Hash: SHA1 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Please try this: <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; From: Argus-info <<a = href=3D"mailto:[email protected]= du"><span = style=3D'color:purple'>[email protected]= ew.cmu.edu</span></a><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>&g= t; > On Behalf Of Kevin Branch<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Sent: Friday, September 28, 2018 5:25 PM<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; To: Carter Bullard <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> = ><span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; Cc: Argus <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>&= gt; ><span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Looks like GeoIP is linked in already: <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; # ldd `which ralabel`<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = linux-vdso.so.1 =3D> (0x00007ffddaf8a000)<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 = (0x00007f5fe67c9000)<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = libpthread.so.0 =3D> /lib/x86_64-linux-gnu/libpthread.so.0 = (0x00007f5fe65ab000)<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 = (0x00007f5fe637c000)<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 = (0x00007f5fe5fb3000)<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = /lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000) <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; I switched to just "lat,lon" like you = suggested in ralabel.conf: <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; # cat /etc/ralabel.conf <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = RALABEL_GEOIP_ASN=3Dyes <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = RALABEL_GEOIP_CITY=3D"lat,lon" <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; But I don't see anything but ASNs getting added in: = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; sAS dAS <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 22927 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 6582 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 7018 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 3 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 4323 21928 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; 2828 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Thoughts? <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Kevin <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard <<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><span = class=3Dapple-converted-space> </span><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> = <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>> > = wrote: <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Hey = Kevin, <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; If you = do a ./configure =E2=80=94help you=E2=80=99ll see all the options that = ./configure supports. If you specify =E2=80=94with-GeoIP it wants = the directory where the GeoIP library is. <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir> <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; You = can check if the library is bound to the client binaries with ldd = =E2=80=A6 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; ldd `which ralabel` <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; If = you=E2=80=99re already bound, the city stuff should work = =E2=80=A6. I=E2=80=99m not familiar with =E2=80=9Creg,cco=E2=80=9D = as GeoIP City objects off the top of my head. I=E2=80=99m familiar = with =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe = try lat,lon as a test, as I use that all the time .. <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; Carter = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; &n= bsp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; <span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; On Sep 28, 2018, at 1:59 PM, = Kevin Branch <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>[email protected]</span></a><<a = href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>>= ; <<a href=3D"mailto:[email protected]"><span = style=3D'color:purple'>mailto:[email protected]</span></a>>= ; > wrote: <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; Hi Carter, <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; I was just trying today to make = ralabel on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even = though the file referred to in ralabel.conf for that purpose exists, no = GeoIP labeling takes place. ASN lookups work great, = but ralabel never adds any scity or dcity fields. <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; My ralabel.conf: <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; RALABEL_GEOIP_ASN=3Dyes <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; RALABEL_GEOIP_CITY=3D"reg,cco" <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; No errors are thrown by = ralabel. I thought maybe I needed to specially compile in GeoIP = support like I read about here: <span = class=3Dapple-converted-space> </span><a = href=3D"https://qosient.com/argus/geolocation.shtml"><span = style=3D'color:purple'>https://qosient.com/argus/geolocation.shtml</span>= </a><span class=3Dapple-converted-space> </span><<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; but when I run = "./configure --with-GeoIP=3Dyes" it throws this error: <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; &nb= sp; configure: WARNING: unrecognized options: --with-GeoIP = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; However, I presume the fact = that ASN lookups work means that MaxMind GeoIP support libraries are = already installed, and presumably installed by default in the latest = argus now. <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; # ra -r /argus/today/unt-01.arg = -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | = head -n20 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; = sAS dAS <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 22927 4323 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 6582 = 4323 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 7018 = 4323 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; = 4323 3 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 15169 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 15169 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 4323 21928 = <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; 2828 = 4323 <<a href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; Any thoughts on what I am = missing or how I might further debug this issue? <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; Thanks! <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; &n= bsp; Kevin <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; <s= pan = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; -----BEGIN PGP SIGNATURE----- <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = &= nbsp; = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; =3Dp/tg<span = class=3Dapple-converted-space> </span><br> &n= bsp; = &= nbsp; -----END PGP SIGNATURE----- <<a = href=3D"http://qosient.com/"><span = style=3D'color:purple'>http://qosient.com/</span></a>><span = class=3Dapple-converted-space> </span><br> &n= bsp; -----BEGIN PGP SIGNATURE-----<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'> = = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F<span = class=3Dapple-converted-space> </span><br> &n= bsp; = IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D<span = class=3Dapple-converted-space> </span><br> &n= bsp; =3DeoBH<span = class=3Dapple-converted-space> </span><br> &n= bsp; -----END PGP SIGNATURE-----<span = class=3Dapple-converted-space> </span><br>-----BEGIN PGP = SIGNATURE-----<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div><d= iv><p class=3DMsoNormal><span = style=3D'font-size:9.0pt;font-family:"Helvetica",sans-serif'>iF0EARECAB0W= IQQP+UHquEepll566aqXCCyZOY1FIQUCW7DgxQAKCRCXCCyZOY1F<span = class=3Dapple-converted-space> </span><br>IW8GAJ9tlHBAzoC4LAVWCw09qF= 4MfwuhOQCg7MxVBI5MKea4aax2551/gQ28mlE=3D<span = class=3Dapple-converted-space> </span><br>=3DCZnI<span = class=3Dapple-converted-space> </span><br>-----END PGP = SIGNATURE-----<span = class=3Dapple-converted-space> </span><o:p></o:p></span></p></div></= div></blockquote></div><p = class=3DMsoNormal><o:p> </o:p></p></div></div></div></div></blockquo= te></div><p = class=3DMsoNormal><o:p> </o:p></p></div></div></div></body></html> ------=_NextPart_000_0046_01D459A1.DA8282E0--